RE: [PATCH v4 3/3] prctl: Allow ptrace capable processes to change /proc/self/exe

[Nicolas Viennot]

> > This is scary.  But I believe it is safe.
> >
> > Reviewed-by: Serge Hallyn <serge@xxxxxxxxxx>
> >
> > I am a bit curious about the implications of the selinux patch.
> > IIUC you are using the permission of the tracing process to execute
> > the file without transition, so this is a way to work around the
> > policy which might prevent the tracee from doing so.
> > Given that SELinux wants to be MAC, I'm not *quite* sure that's
> > considered kosher.  You also are skipping the PROCESS__PTRACE to
> > SECCLASS_PROCESS check which selinux_bprm_set_creds does later on.
> > Again I'm just not quite sure what's considered normal there these
> > days.
> >
> > Paul, do you have input there?
>
> I agree, the SELinux hook looks wrong.  Building on what Christian said, this looks more like a ptrace operation than an exec operation.

Serge, Paul, Christian,

I made a PoC to demonstrate the change of /proc/self/exe without CAP_SYS_ADMIN using only ptrace and execve.
You may find it here: https://github.com/nviennot/run_as_exe

What do you recommend to relax the security checks in the kernel when it comes to changing the exe link?

    Nico